Solved IP Blacklisted but still getting through

[michaelholt]

As the subject says, I have blacklisted an IP address but it is still getting through trying to register. Because registration via WAN is turned off, they can't make a phone call. Also, I am getting this message exactly every 8 minutes:

The IP 195.154.214.162 has been blacklisted for 1800 sec. (Expires at: 2017/0212 23:56:41).

Reason: Too many failed authentications!​

I have done these things:
1. Blacklisted the IP
2. Blocked the IP at the firewall

None of these things have stopped these messages. Also, every 2 minutes, this IP tries to register with an extension which does get blocked but if the IP is blacklisted, how does it get this far?

 

[YiannisH_3CX]

Hello @michaelholt

This sounds very strange indeed. What version PBX are you on? Since you blocked it at your firewall level it shouldn't reach the PBX server.
Make sure you block the IP to port 5060 TCP and UDP and see if that males a difference. Also when did this start? Could it be that the messages you are getting happened prior to the IP being blocked?

 

[michaelholt]

You know, I only blocked tcp as I was in a hurry. That's an awesome suggestion. Thank you. I'll see what happens after that.

That hacker has now apparently stopped as the messages quit. I guess they went to bed. They are in France.

Also, the 3CX server rebooted to which all the messages stopped at that time. This makes me wonder if a service in 3CX was somehow preventing the ip blacklist. I am so glad for the WAN registration block.

 

[YiannisH_3CX]

I am assuming that the messages you saw where generated before the number was blacklisted as they should normally be blocked by your firewall.
Keep an eye on it and us know how it goes

 

[michaelholt]

All is good now. Thank you so much for your help. Without your suggestion, I might not have went back and looked at udp. You saved my entire night as I would have been up trying to stop it before everyone came in at about 5am.

 

[YiannisH_3CX]

Glad to hear the issue is resolved